A federal appeals court has ruled Microsoft and other companies cannot be forced to turn over customer emails stored on servers outside the United States, handing a victory to privacy advocates.

Microsoft sues for right to tell customers when US government requests emails

Read more

US law doesn’t work outside the country, the second US circuit court of appeals in New York ruled on on Thursday, reversing a 2014 lower court order directing Microsoft to comply with a warrant to turn over to the US government the contents of a customer’s email account stored on an Irish server.

“The [stored communications act] SCA warrant in this case may not lawfully be used to compel Microsoft to produce to the government the contents of a customer’s email account stored exclusively in Ireland,” wrote Judge Susan Carney. “Because Microsoft has otherwise complied with the Warrant, it has no remaining lawful obligation to produce materials to the government.”

Brad Smith, Microsoft president and chief legal officer, told the Guardian he hoped the ruling paved the way for new legislation. The US Department of Justice has been criticized by Congress for its reliance on case law, notably during the recent Apple-FBI battle over San Bernardino killer Syed Farook’s iPhone.

“Fundamentally what it means is that people can have confidence that when they store information in the cloud, their privacy rights can be governed by their own laws and interpreted by their own governments,” Microsoft president and chief legal officer Brad Smith told the Guardian in an interview Thursday afternoon.

“The US government has a decision to make: we can even spend the next two years arguing about a law that was passed thirty years ago, or we can talk about a law that is focused on the future,” Smith said.

The court also voided a finding of contempt against Microsoft.

Carney said warrants issued under the SCA reach only data stored within the United States, and that US service providers cannot be forced to comply with warrants seeking data stored elsewhere.

Microsoft had been the first US company challenging a warrant seeking data held outside the country.

The ruling, said Smith, was a victory for the tech sector which increasingly relies on privacy as a selling point. “People will only use technology they trust,” he said. “That trust has been at issue on a number of fronts. This bolsters confidence that their documents in the cloud won’t be subject to unilateral seizure by the US government. It’s very important that people’s privacy rights be subject to their local laws as interpreted by their own governments.”

Indeed, the Irish government had said it would have gladly helped the US Department of Justice obtain the records in question, related to a drug trafficking investigation, but they were not consulted.

Victor Bolden, one of the three-judge panel alongside Carney and Gerard Lynch, characterized the warrant as “a subpoena dressed up as a warrant that also has the powers of a subpoena” to a DOJ lawyer in September. The lawyer agreed with the characterization.

Microsoft had warned that enforcing its warrant could spark a “global free-for-all” that would eviscerate personal privacy, and prompt law enforcement authorities elsewhere to seize emails belonging to Americans and stored in the United States.

The case has attracted strong interest from the technology and media sectors.